GO-2020-0047

See a problem?
Source
https://pkg.go.dev/vuln/GO-2020-0047
Import Source
https://vuln.go.dev/ID/GO-2020-0047.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2020-0047
Aliases
Published
2021-04-14T20:04:52Z
Modified
2024-05-20T16:03:47Z
Summary
Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml
Details

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.

References

Affected packages

Go / github.com/RobotsAndPencils/go-saml

Package

Name
github.com/RobotsAndPencils/go-saml
View open source insights on deps.dev
Purl
pkg:golang/github.com/RobotsAndPencils/go-saml

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/RobotsAndPencils/go-saml",
            "symbols": [
                "AuthnRequest.Validate",
                "NewAuthnRequest",
                "NewSignedResponse",
                "ServiceProviderSettings.GetAuthnRequest"
            ]
        }
    ]
}